I do pre-launch payment reviews, so I end up looking at a lot of Stripe setups right before they go live. The same handful of bugs show up over and over, and most of them are quiet. Nothing throws an error, you just leak money or hand out free access. Sharing the ones I catch most often in case it saves someone a rough first month. 1) The webhook never verifies the signature. Tons of integrations just parse the JSON body and trust it. Anyone who finds your endpoint can POST a fake "subscr...